Editorial Policy

9 Steps to Take After Your Card Gets Hacked

Allie Johnson

July 10, 2013

You log in to your card account and spot a suspicious charge. Or you get a message about possible fraud from your credit card company. Or maybe your card gets declined unexpectedly at the grocery store. Suddenly, you find out you've got a problem: Your credit card has been hacked.

Even if your card is never physically stolen and still resides in your wallet, your credit card number can be lifted in a variety of ways, from a restaurant waiter swiping your information, to an information-stealing skimming device installed on a gas pump, to criminals hacking into a retailer's computer system.

Learning that your card number has been compromised can be scary, but don't panic. You can fix the problem if you follow these nine steps:

1. Contact your credit card company right away. When your credit card is compromised, your card issuer has just as strong an interest in clamping down on fraud as quickly as you do, says Nessa Feddis, an attorney and senior vice president at the American Bankers Association. That's because fraud costs them a lot of money, she says. So, call the number on the back of your card and explain what happened.

2.  Cooperate with your card issuer. It's likely that you will get transferred to your credit card company's fraud department, Feddis says. You'll be asked a series of questions, such as whether your card has been out of your possession and exactly which charges were unauthorized. Most consumers have no idea how their account information was compromised, Feddis says. But tell your card issuer if you have any specific suspicions, she recommends. If not, don't worry about it: “Banks and Visa and MasterCard have very sophisticated systems to try to identify the point of compromise,” Feddis says.

3. Close the compromised account and get a new card. It's important to close the old account right away, says Eva Velasquez, president and CEO of the nonprofit Identity Theft Resource Center (ITRC), which offers free help for consumers. The credit card company typically will then send you new credit card with a new account number. If the old card is set up for recurring charges, such as for iTunes or Netflix, you'll need to update that account information once you have the new card.

4. Follow up in writing. In some cases, your credit card company will require you to fill out and submit a written report, Feddis says. And even if it's not required, she says it's a good idea to submit a statement detailing the fraud in writing — either via the card issuer's website, by email or by postal mail. In fact, the Federal Trade Commission recommends sending a certified letter detailing what happened and keeping a copy.

5. Continue to watch your account. Check your account frequently for any additional suspicious charges, and notify your credit card company immediately if you see any other unauthorized charges, Feddis says.

6. Step up security measures. Becoming more security conscious can help prevent more fraud in the future. Change your online passwords to your credit card and other financial accounts, making sure you use an alphanumeric password with at least eight characters and a mix of upper- and lowercase letters, Velasquez says.

“The longer the password, the harder it's going to be to crack,” she says.

Velasquez also recommends sorting through your purse or wallet so you're carrying only what you need. For example, never carry your Social Security card with you, she says.

7. Get the results of the investigation. Your card issuer will investigate the fraudulent charge. By federal law, the consumer is liable for a maximum of $50 of an unauthorized charge, and many credit card companies offer $0 liability. The issuer should notify you of the outcome of the investigation and any action it has taken, such as removing the fraudulent charge.

8. Consider taking additional steps. Depending which information was compromised and on your own comfort level, you might want to take additional steps. For example, you can put 90-day fraud alerts on your credit reports with all three major credit bureaus, Velasquez says. You'll only have to contact one of the bureaus, as it will inform the other two.

The alerts tell lenders to take extra steps to verify your identity before opening new accounts in your name. It's probably not necessary if your credit card number was the only information compromised, Velasquez says, “But it can't hurt.”

9. Monitor your credit. In some cases, thieves might have gained access not only to your credit card number but also to other personal information they can use to open new accounts in your name or engage in other types of fraud. So, it's smart to pull your credit reports at AnnualCreditReport.com, where you can get a free report from each major bureau once a year.

“You should be doing that anyway and you don't want to take chances,” Velasquez says.

If criminals got more than your credit card number, she says, “The aftermath can be devastating.”

The ITRC recommends that consumers monitor their own credit. If you do sign up for an ID theft monitoring service, make sure you read the fine print and know exactly what you're getting for your money, Velasquez recommends.

Finally, make sure to check your credit card accounts frequently and even consider using online banking and setting up alerts to notify you of purchases over a certain dollar amount.

“It's not a bad idea to check your account [for unauthorized purchases] every day,” Feddis says. “And it can help you manage your spending, too.”